Security

GitLab Addresses Critical Remote Code Execution Vulnerability

GitLab has released patches for a maximum-severity vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler, which could allow unauthenticated attackers to execute arbitrary code via specially crafted regular expressions.

AI-generated editorial illustration of the article topic; not a photograph, product screenshot or measured result.

Vulnerability Details and Discovery

GitLab has issued a warning about a maximum-severity vulnerability in its CI/CD Regular Expression Compiler, which could allow remote attackers to execute arbitrary code on targeted instances. Tracked as CVE-2026-97229, the flaw was discovered by a security researcher using the 'joaxcar' handle and reported through GitLab's HackerOne bug bounty program. The vulnerability stems from an integer overflow weakness in the compiler, which processes regular expressions in pipeline configuration files. GitLab explained that the issue could have allowed an unauthenticated user to execute arbitrary code on the server via a specially crafted regular expression due to insufficient validation. The company has released patches for GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 19.2.8, 19.3.4, and 19.4.2, urging users to upgrade immediately to address the risk.

Impact and Affected Versions

GitLab has identified a maximum severity code execution vulnerability affecting multiple versions of its Community Edition (CE) and Enterprise Edition (EE) software. The flaw impacts versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2, according to GitLab. Users of these versions are urged to apply patches immediately to prevent potential exploitation. GitLab Dedicated customers are not affected and do not need to take action. This vulnerability is part of a series of security issues addressed by GitLab in recent months, including a high-severity two-factor authentication bypass (CVE-2026-0723) and a maximum-severity flaw (CVE-2026-85706) that allowed unauthenticated attackers to access sensitive data. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its catalog of actively exploited vulnerabilities and mandated federal agencies to secure their systems within three days.

User Base and Security Context

GitLab has highlighted a critical code execution vulnerability affecting its platform, with implications for its extensive user base. According to CISA, five GitLab flaws have been exploited in attacks since November 2021, including one used by ransomware gangs. GitLab reports that over 30 million registered users and more than 50% of Fortune 100 companies rely on its DevSecOps platform, including major organizations like Nvidia, T-Mobile, Lockheed Martin, Airbus, and Goldman Sachs. The vulnerability was discovered during an analysis of the OAuth flow shared by Google’s developer docs sites. The researcher noted that the session format used by Flask, which includes the client_id and client_secret in plaintext, allowed for the identification of a signature verification flaw. This finding underscores the importance of secure session management in authentication systems.

Exploitation and Verification

GitLab has identified a critical vulnerability that allows for remote code execution, highlighting the potential for exploitation through session manipulation. According to evidence, an attacker could alter session data and generate a valid signature that the server would accept, enabling unauthorized access. By modifying the session structure and crafting a malicious payload, an attacker could inject arbitrary data, including a custom CSRF token and a malicious pickle object. The server would then process this data without validation, leading to the execution of arbitrary code. As noted, the vulnerability hinges on the server's failure to verify the integrity of the session data, allowing an attacker to bypass security checks. This flaw underscores the importance of rigorous input validation and secure session management practices. GitLab has confirmed the issue and is working on a resolution, though specific details on the exploit's impact remain under investigation.

Timeline and Resolution

GitLab identified a critical vulnerability that allowed remote code execution through a crafted payload. The exploit involved a class that, when deserialized, triggered time.sleep(N) on the server, with delays matching the specified number of seconds. This confirmed that the server imported the time module and executed the sleep command, revealing a serious flaw in session handling.

The vulnerability impacted multiple services hosted on Google’s shared DevSite platform, including firebase.google.com, developer.android.com, and others. Resolution required four key changes: rotating OAuth client secrets, invalidating all sessions tied to them, assigning unique high-entropy SECRET_KEY values for each deployment, and ensuring these keys were stored server-side and unrelated to OAuth credentials.